Privacy Policy (Datenschutz)
Last updated: November 3, 2026
1. Controller
Cazo Ya
Köpenicker Str. 54, 10179 Berlin, Germany
E-mail: Saharo@hotmail.com
2. Summary
- This website uses no tracking or advertising. The only cookie is the technically necessary session cookie of the account panel.
- Your data is not sold.
- Fonts and images are loaded from our own server, not from third parties.
- Chat messages in the game are not recorded.
3. Hosting and visiting this website
The website and game server run on a server of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in a data center in Nuremberg. A data processing agreement under Art. 28 GDPR is in place with netcup.
When you visit the website, the web server processes your IP address, the date and time, the requested page, the status code, the previously visited page and your browser identification, as this is technically necessary. This serves the secure and stable operation of the website, in particular defending against attacks. The legal basis is Art. 6 (1) (f) GDPR. These logs are deleted after 14 days.
The connection to the website is encrypted with TLS.
4. Game account
An account is required to play and is created with the registration form on this website. Without the data marked with *, an account cannot be maintained. The legal basis is Art. 6 (1) (b) GDPR.
To protect the registration against mass sign-ups, your IP address is stored only as a keyed hash, for 24 hours, and is used only to limit the number of new accounts per connection (Art. 6 (1) (f) GDPR). The e-mail address is not verified and is not used for advertising.
- User name*, password* (stored as a hash, not in plain text), e-mail address*, gender of the character*
- Date of birth and PIN, if provided
- Time and IP address of the last login, number of logins
- Account status, such as bans and permissions
Account panel: When you sign in, a session cookie is set that is strictly necessary for this function (§ 25 (2) no. 2 TDDDG). It contains no personal data, is not used for tracking and ends when you sign out, close the browser or after 30 minutes of inactivity. To protect accounts against password guessing, failed logins are stored as keyed hashes of the IP address and user name for 15 minutes (Art. 6 (1) (f) GDPR). In the panel you can see your account data and characters and change your password and e-mail address.
5. Data in the game
To operate the game, your characters and their progress are stored, such as name, level, class, inventory, guild and party (Art. 6 (1) (b) GDPR). If you use the AutoHunt feature, its settings and status are exchanged with the server.
Publicly visible on the website and in the game are character names, guilds and ranking values, and for open vendor shops the character name, shop title, offers and location in the game. Your user name, e-mail address and IP address are not displayed.
6. Security logs
To prevent fraud and abuse, investigate incidents and fix errors, the server logs the following events. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is a fair and secure game.
| Log | Content | Retention |
|---|---|---|
| Login | Time, IP address, user name, result | 90 days |
| Character selection | Time, account, character, stats | 90 days |
| Game events | Items, cash points, feeding, NPC messages, GM and player commands, with time and character | 90 days |
| IP bans | IP address, period, reason | Until the ban expires |
7. Game client check
At login, the game client transmits a checksum (MD5) of its program files SahaRO.exe and ijl15.dll. The server compares it with the expected values and rejects modified clients. This is strictly necessary for the fair game operation requested by the player (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (b) and (f) GDPR). No other files, programs or processes on your device are checked or transmitted in this process.
8. Backups
The game database is backed up daily. Backups are kept on the server for 14 days and are transferred in encrypted form to a computer of the operator, where they are deleted after 30 days. They contain the account, game and log data named above and are used only for restoration (Art. 6 (1) (f) GDPR). Deleted data therefore disappears from the backups only when these periods expire.
9. Retention of account and game data
Account and game data is stored for as long as this server exists, unless you have it deleted earlier. You can delete your account in the account panel: the game login is blocked at once, and account, characters, items and storage are removed after 14 days, unless you cancel before then. You can also write to us. When the server is permanently shut down, this data is deleted. Security logs (section 6) and backups (section 8) remain until their own periods end. Beyond that, data is kept only where a legal obligation or an ongoing case of abuse requires it. The shorter periods in sections 3, 6 and 8 take priority for the data listed there.
10. Discord and other external links
Links to Discord and other services are plain links. Data is sent to the provider only when you click the link. The provider's privacy policy then applies, and data may be transferred to countries outside the EU. We do not transfer any data to third countries ourselves.
11. Children and young people
Persons under the age of 16 may only create an account with the consent of their parents or guardians. Parents or guardians may request the deletion of an account created without their consent.
12. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An informal message to the e-mail address above is sufficient. To prevent data from reaching unauthorized persons, we may ask for proof that the account belongs to you.
Right to object: Where processing is based on Art. 6 (1) (f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).
You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority at your place of residence.
13. No automated decisions
No automated decision-making within the meaning of Art. 22 GDPR takes place. Rejecting a modified client at login only prevents the connection and does not change anything in your account.